You can create a fine-grained administrative authorization
group by selecting administrative resources to be part of the authorization
group. You can assign users or groups to this new administrative authorization
group and also give them access to the administrative resources contained
within.
Before you begin
You must be logged into the administrative console with cell-level Admin
Security Manager authority, or the primary administrative ID can
make these changes as well.
Procedure
- Navigate to .
- Type a name for the administrative authorization group
into the Name field. This is a required field. The
name must be unique within the cell structure. If the name is not
unique then the new administrative authorization group is not created
at the end of this procedure.
- Select the resources from the Resource section to which
you want the new administrative authorization group to control access.
Resources that are displayed in black text are available
for selection.
Resources that are displayed in grey are already
members of a different administrative authorization group. Therefore,
these resources are not available for inclusion in the new administrative
authorization group. When a resource is a member of a different authorization
group, the name of the group displays next to the resource name. For
example: server_1 (group_1)
Your filtering options include the
following:
- Nodes. (All of the resources associated with the nodes.)
- Servers. (All of the resources associated with the servers.)
- Web servers. (All of the resources associated with the web
servers.)
- Clusters. (All of the resources associated with the clusters.)
- Applications. (All of the resources associated with the applications.)
- Node groups. (All of the resources associated with the Node
Groups.)
- All scopes. (The default view that displays the authorization
group tree.)
- Assigned scopes. (Displays all of the scopes explicitly assigned
to the current authorization group.)
- Click OK or Apply.
- If you want to associate a user role to this new administrative
authorization group, do the following:
- Click Administrative user roles located under
the Additional Properties section. The available user roles
are the following:
- Administrator
- An individual or group that uses the administrator role has the
operator and configurator privileges plus additional privileges that
are granted solely to the administrator role. For example, an administrator
can complete the following tasks:
- Modify the server user ID and password.
- Configure authentication and authorization mechanisms.
- Enable or disable administrative security.
- Enable or disable Java 2
security.
- Change the Lightweight Third Party Authentication (LTPA) password
and generate keys.
- Create, update, or delete users in the federated repositories
configuration.
- Create, update, or delete groups in the federated repositories
configuration.
Note: An administrator cannot map users and groups to the administrator
roles.
.
- Configurator
- An individual or group that uses the configurator role has the
monitor privilege plus the ability to change the WebSphere® Application
Server configuration. The configurator can perform all the day-to-day
configuration tasks. For example, a configurator can complete the
following tasks:
- Deployer
- Users granted this role can perform both configuration actions
and runtime operations on applications..
- Operator
- An individual or group that uses the operator role has monitor
privileges plus ability to change the runtime state. For example,
an operator can complete the following tasks:
- Stop and start the server.
- Monitor the server status in the administrative console.
- Monitor
- An individual or group that uses the monitor role has the least
amount of privileges. A monitor can complete the following tasks:
- View the WebSphere Application Server configuration.
- View the current state of the Application Server.
- Admin Security Manager
- Using the Admin Security Manager role, you can assign users and
groups to the administrative user roles and administrative group roles.
However, an administrator cannot assign users and groups to the administrative
user roles and administrative group roles including the Admin Security
Manager roles.
- Click Add.... The New User page
is displayed.
- Select the appropriate role(s) from the Role(s) list
box.
- Select a user or users by entering text in the Search
string field, and then click Search.. Click the arrow to
add the available user or users to the Mapped to role field.
You can select multiple users and roles by clicking Select
All.
- Click OK. You are returned to
the Administrative User Roles page. The new users are displayed in
the Administrative User Roles table along with their appropriate roles.
- Repeat steps B through E for each new user to whom you
want to map a role.
- If you want to associate a group to this new user role,
do the following:
- Click Administrative group roles located under
the Additional Properties section.
- Click Add.... The New Group
page is displayed.
- Select the appropriate role or roles from the Role(s) list
box.
- Select a user or users by entering text in the Search
string field, and then click Search.. Click the arrow to
add the available user or users to the Mapped to role field.
You can select multiple users and roles by clicking Select
All.
- Select either the Select from special subjects or Map
Groups As Specified Below option.
If
you select the Select from special subjects option, you can
select the ALL AUTHENTICATED, or ALL AUTHENTICATED IN TRUSTED REALMS
values. ![[Updated in September 2012]](../../deltaend.gif)
sep2012
A list of user groups and roles are
displayed in the Available and Mapped to role fields.
Select the user groups from the Available field and then select
the roles from the Mapped to role field to which you want the
group or groups associated. You can select multiple groups and roles.
- Click OK. You are returned to
the Administrative Group Roles page. The new group is displayed in
the Administrative Group Roles table along with the role of the new
group.
- Repeat steps B through E for each new group to whom
you want to map a role.
- If you want to create another administrative authorization
group, click Apply. The current administrative
authorization group is created. Repeat steps 2 through 6 to create
another administrative authorization group.
- If you do not want to create another administrative authorization
group, click OK.